A lawsuit has been filed against Disney by a mother who accused the company of illegally tracking children through their online apps. The suit alleges Disney violated the Children’s Online Privacy Protection Act through the use of an ad-specific software kit, included in the app’s code, that allows Disney to track online behavior and collect personal information on users.

As reported by the Daily Mail, Amanda Rushing, a mother from San Francisco, filed the lawsuit against The Walt Disney Company, Disney Electronic Content, and other affiliated organizations on Thursday on behalf of her child, who is only identified as “L. L.,” who used the Disney Princess Palace Pets app.

The ad-specific software kit targeted in the suit is also claimed to be included in a variety of other Disney apps aimed at children, including Disney Built It Frozen, Cars Lightning League, and Zootopia.

The proposed class action lawsuit, which was filed in California federal court, alleges that the information collected is ultimately sold to numerous third-parties whose business revolves around selling targeted online advertising.

Michael Sobol, Rushing’s attorney, stated that the Children’s Online Privacy Protection Act was created specifically to protect minors from this very scenario.

“Disney has failed to safeguard children’s personal information and ensure that third-parties’ collection of data from children is lawful,” wrote Sobol in the lawsuit.

“Congress enacted the Children’s Online Privacy Protection Act for very good reasons.”

Sobol stated that the technology in the apps allows “app developers and their SDK-providing partners” to “track children’s behavior while they play online games with their mobile devices by obtaining critical pieces of data from the mobile devices, including ‘persistent identifiers,’ typically a unique number linked to a specific mobile device.”

He went on to say, “These persistent identifiers allow SDK providers to detect a child’s activity across multiple apps and platforms on the internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps. This information is then sold to various third-parties who sell targeted online advertising.”

“As a company long-engaged in the practice of engaging – and profiting from – children, Disney needs to make sure its games and apps comply with the law,” continued Sobol.

“[Disney] and the companies they work with always have to obtain verifiable parental consent before extracting kids’ data from their mobile devices when kids play Disney’s mobile apps.”

The Children’s Online Privacy Protection Act restricts the activities of online sites aimed at children under the age of 13. It also provides parents with a mechanism for halting third-party advertisers and app developers from tracking and profiting from the data of children.